keese

Status: alpha · DESIGN GATE: OPEN (since 2026-04-22) — all 62 designs and 27 specs scored ≥ 90/100 against docs/plans/rubric.md and the gate-open audit signed off. 18 reconcilers, 21 CRD types across 3 API groups, and 4 binaries are implemented on main. New: the user documentation site (mkdocs) — start there, or see the roadmap for what is built vs. planned.

Secure multi-tenant, multi-workspace Kubernetes operator orchestrating autonomous AI agent workflows on pluggable agent runtimes (goose first). Namespaces are the tenant boundary. Workspaces span one or more pods running an agent runtime. Identity is a projected Kubernetes ServiceAccount token; authorization is ReBAC (OpenFGA); egress flows through Envoy AI Gateway, which terminates the agent's SA token and injects the correct upstream credential per target. Composition over new CRDs — Capsule for tenants, Argo Workflows for workflow execution, Knative for outputs.

If you are Claude Code

Read in this order, stop when the task is answered:

1. CLAUDE.md — task → doc → skill routing table.
2. .claude/rules/ — always-loaded non-negotiables (01 conventions · 02 security · 03 context-mgmt · 04 kubernetes · 05 zero-trust · 06 signal-handling · 06 testing).
3. docs/plans/README.md — phase index + gate status.
4. Task-specific doc per the routing table in CLAUDE.md.

Do not rg the whole tree until routed. Do not load all designs or specs at once.

Repo map

Path	Purpose
CLAUDE.md	Task-to-doc-to-skill index (always in prompt cache)
MEMORY.md	Cross-session decision index
.claude/	Agents, commands, hooks, rules, skills, settings
docs/designs/	WHY — architecture decisions (≤ 200 lines each)
docs/specs/	WHAT — testable contracts (authored AFTER designs)
docs/plans/	HOW (phased) + rubric + flake-log
docs/features/	WHAT IS BUILT (post-gate)
docs/references/	HOW (steady-state) cookbooks
book/	User-facing documentation (mkdocs-material site)
api/	CRD Go types — 21 types across keese.ai / authz.keese.ai / policy.keese.ai
internal/controller/	Reconcilers — 18 controllers (implemented; gate open)
internal/runtime/	Agent runtime SPI + providers (goose; ADK Python/Go stubs)
cmd/	Binaries — operator manager, keese-authz, keese-drain, keese-wf-launcher, keese-cosign-webhook
config/	Kustomize base + overlays (dev/, kind/, prod/)
deploy/opentofu/	Cloud deploy — aws/ gcp/ azure/
dev/	Local infra bootstrap (kind, tilt, helmfile)
dev/ide/	GoLand + VSCode dlv/debug configs
bundle/	OLM bundle (generated)
scripts/	Helpers + dispatch/merge + design-gate check

Design gate

The design gate opened on 2026-04-22, once all 62 designs and 27 specs reached status: current with honest rubric scores ≥ 90 (see the gate-open audit). Controller and API code now lands freely on main. Two guards remain enforced by scripts/check-design-gate.sh and GitHub Actions: a spec may not be authored before its owning designs are current, and the gate-open commit is verified (verify-gate-commit.yaml). See docs/plans/README.md for phase status.

Quickstart

direnv allow            # loads nix develop shell
pre-commit install --install-hooks
pre-commit install --hook-type commit-msg
make help               # target catalog

Local Kubernetes (kind + Tilt — see the install guide):

make kind-up            # ctlptl-managed kind cluster
make bootstrap-infra    # helmfile sync dev deps (cert-manager, Capsule,
                        #   Envoy AI Gateway, OpenFGA, NACK/NATS, ECK,
                        #   OpenBao, ExternalSecrets, Argo, Qdrant,
                        #   Kyverno, OTEL)
make tilt-up            # hot-reload the operator

Contributing

See CONTRIBUTING.md and .claude/rules/01-conventions.md. Commits use Conventional Commits (hook-enforced). Every source file carries an SPDX Apache-2.0 header. Rubric in docs/plans/rubric.md.

Supply-chain posture

The OpenSSF Best Practices badge above links to project ID 0 (placeholder). Enroll at https://www.bestpractices.dev/ and update this link — tracked in docs/references/scorecard-deferrals.md.

Security posture (5 invariants)

• Agent runtime pods never see Kubernetes API kubeconfigs or upstream LLM/MCP credentials. Identity is a projected SA token with audience keese-egress-<tenant>; TTL 10m.
• All network egress flows through Envoy AI Gateway, fail-closed. No wildcard NetworkPolicies anywhere.
• Authorization is ReBAC (OpenFGA). Every authz-affecting CRD field is marked // +keese:rebac-tuple=... and paired with a design-doc reference.
• Upstream credentials live only in OpenBao (or cloud KMS) and are swapped for the agent's SA token at the gateway via BackendSecurityPolicy. They are never returned to the agent.
• Bundle + operator images are signed via Sigstore cosign (keyless OIDC); operator-sdk bundle validate and OpenSSF scorecard gate releases.

See SECURITY.md for vulnerability reporting and .claude/rules/05-security-zero-trust.md for the full rule set.

License

Apache-2.0. Copyright (c) 2026 keese-ai. Maintainers listed in CODEOWNERS.